21+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-26T20:50:12.243+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-05-26T20:50:13.249+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-26T20:50:15.278+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-26T20:50:16.302+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 44 events 2026-05-26T20:50:17.294+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 4 events 2026-05-26T20:50:18.318+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-26T20:50:19.325+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-05-26T20:50:19.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177031,"time":{"ms":31}},"total":{"ticks":2160156,"time":{"ms":281},"value":2160156},"user":{"ticks":1983125,"time":{"ms":250}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":112230665}},"memstats":{"gc_next":5200320,"memory_alloc":3791320,"memory_total":318497792296}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":630,"batches":24,"total":630},"read":{"bytes":144},"write":{"bytes":139745}},"pipeline":{"clients":3,"events":{"active":36,"published":648,"total":648},"queue":{"acked":630}}},"msg_file_cache":{"ApplicationMisses":1,"ApplicationSize":1,"SecurityHits":646,"SystemHits":1},"published_events":{"Application":1,"Security":628,"System":1,"total":630}}}} 2026-05-26T20:50:20.354+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-26T20:50:21.368+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-26T20:50:22.370+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-26T20:50:24.404+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-26T20:50:25.420+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-26T20:50:26.423+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-05-26T20:50:27.456+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-26T20:50:29.462+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-26T20:50:30.488+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 40 events 2026-05-26T20:50:32.512+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-26T20:50:33.507+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 1 events 2026-05-26T20:50:34.532+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-26T20:50:35.535+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-05-26T20:50:36.558+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-26T20:50:37.583+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-26T20:50:38.588+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-05-26T20:50:39.605+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-05-26T20:50:40.625+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-26T20:50:41.635+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-26T20:50:43.650+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-26T20:50:44.674+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-26T20:50:45.681+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-26T20:50:46.723+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 61 events 2026-05-26T20:50:47.722+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-05-26T20:50:48.734+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-26T20:50:49.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177093,"time":{"ms":62}},"total":{"ticks":2160452,"time":{"ms":296},"value":2160452},"user":{"ticks":1983359,"time":{"ms":234}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":112260665}},"memstats":{"gc_next":8231248,"memory_alloc":5117536,"memory_total":318561065032}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":697,"batches":25,"total":697},"read":{"bytes":150},"write":{"bytes":154290}},"pipeline":{"clients":3,"events":{"active":27,"published":688,"total":688},"queue":{"acked":697}}},"msg_file_cache":{"SecurityHits":688},"published_events":{"Security":697,"total":697}}}} 2026-05-26T20:50:49.750+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-05-26T20:50:51.763+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-26T20:50:52.784+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-26T20:50:53.792+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-26T20:50:54.793+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 6 events 2026-05-26T20:50:56.843+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 60 events 2026-05-26T20:50:57.829+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 3 events 2026-05-26T20:50:58.841+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-05-26T20:50:59.858+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-26T20:51:00.885+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-26T20:51:01.888+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-05-26T20:51:02.913+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 38 events 2026-05-26T20:51:03.923+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-05-26T20:51:04.938+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-05-26T20:51:05.968+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 49 events 2026-05-26T20:51:06.966+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 9 events 2026-05-26T20:51:08.010+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 46 events 2026-05-26T20:51:09.024+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-26T20:51:11.026+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-26T20:51:12.066+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 44 events 2026-05-26T20:51:13.078+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-26T20:51:15.077+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 3 events 2026-05-26T20:51:16.095+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-26T20:51:17.133+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 57 events 2026-05-26T20:51:18.140+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-26T20:51:19.158+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-05-26T20:51:19.685+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177140,"time":{"ms":47}},"total":{"ticks":2160718,"time":{"ms":266},"value":2160718},"user":{"ticks":1983578,"time":{"ms":219}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":112290665}},"memstats":{"gc_next":8228144,"memory_alloc":4562960,"memory_total":318624828776}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":679,"batches":26,"total":679},"read":{"bytes":156},"write":{"bytes":148739}},"pipeline":{"clients":3,"events":{"active":12,"published":664,"total":664},"queue":{"acked":679}}},"msg_file_cache":{"SecurityHits":664},"published_events":{"Security":679,"total":679}}}} 2026-05-26T20:51:20.164+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-26T20:51:22.211+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 66 events 2026-05-26T20:51:23.200+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 2 events 2026-05-26T20:51:24.210+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-26T20:51:25.233+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-26T20:51:26.240+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-26T20:51:27.265+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-26T20:51:28.281+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-26T20:51:29.297+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-26T20:51:30.306+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-05-26T20:51:31.336+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-05-26T20:51:33.361+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 40 events 2026-05-26T20:51:34.367+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-05-26T20:51:35.387+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-26T20:51:36.384+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 4 events 2026-05-26T20:51:37.419+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 49 events 2026-05-26T20:51:39.425+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-26T20:51:41.460+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-26T20:51:42.474+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-26T20:51:44.487+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-26T20:51:45.495+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-05-26T20:51:47.533+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-05-26T20:51:48.547+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-26T20:51:49.559+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-26T20:51:49.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177171,"time":{"ms":31}},"total":{"ticks":2160983,"time":{"ms":265},"value":2160983},"user":{"ticks":1983812,"time":{"ms":234}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":112320665}},"memstats":{"gc_next":5639040,"memory_alloc":3426752,"memory_total":318685166464,"rss":-53248}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":6lly published 15 events 2026-05-27T03:31:31.946+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 7 events 2026-05-27T03:31:32.962+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T03:31:34.003+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 61 events 2026-05-27T03:31:36.003+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T03:31:38.055+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 60 events 2026-05-27T03:31:39.054+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-27T03:31:40.065+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-27T03:31:41.103+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 50 events 2026-05-27T03:31:42.111+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T03:31:43.123+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-27T03:31:44.138+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-27T03:31:45.148+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-27T03:31:46.169+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:31:47.172+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-05-27T03:31:49.191+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:31:49.686+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":206734,"time":{"ms":47}},"total":{"ticks":2465390,"time":{"ms":360},"value":2465390},"user":{"ticks":2258656,"time":{"ms":313}}},"handles":{"open":317},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":136320666}},"memstats":{"gc_next":5348832,"memory_alloc":3532808,"memory_total":373955827376}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":727,"batches":26,"total":727},"read":{"bytes":156},"write":{"bytes":157026}},"pipeline":{"clients":3,"events":{"active":49,"published":758,"total":758},"queue":{"acked":727}}},"msg_file_cache":{"SecurityHits":758,"SystemSize":-1},"published_events":{"Security":727,"total":727}}}} 2026-05-27T03:31:50.222+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 49 events 2026-05-27T03:31:51.225+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T03:31:52.231+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-27T03:31:53.254+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-05-27T03:31:54.265+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T03:31:55.267+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-05-27T03:31:57.291+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:31:58.311+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-27T03:31:59.334+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-27T03:32:00.338+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T03:32:01.339+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 5 events 2026-05-27T03:32:02.364+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-27T03:32:03.376+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T03:32:04.377+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 1 events 2026-05-27T03:32:06.408+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-05-27T03:32:07.412+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-05-27T03:32:08.430+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T03:32:09.456+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-27T03:32:10.468+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T03:32:11.489+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T03:32:12.509+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:32:13.523+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:32:15.559+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-27T03:32:16.560+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-05-27T03:32:17.566+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-27T03:32:19.607+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 59 events 2026-05-27T03:32:19.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":206734},"total":{"ticks":2465718,"time":{"ms":328},"value":2465718},"user":{"ticks":2258984,"time":{"ms":328}}},"handles":{"open":317},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":136350665}},"memstats":{"gc_next":8497488,"memory_alloc":4909424,"memory_total":374019770456,"rss":-487424}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":700,"batches":26,"total":700},"read":{"bytes":156},"write":{"bytes":154214}},"pipeline":{"clients":3,"events":{"active":17,"published":668,"total":668},"queue":{"acked":700}}},"msg_file_cache":{"ApplicationSize":-1,"SecurityHits":668},"published_events":{"Security":700,"total":700}}}} 2026-05-27T03:32:20.607+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T03:32:21.628+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T03:32:23.647+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:32:24.662+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-27T03:32:25.672+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-27T03:32:26.698+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 42 events 2026-05-27T03:32:28.714+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-05-27T03:32:29.730+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-05-27T03:32:30.736+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-05-27T03:32:31.766+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 38 events 2026-05-27T03:32:32.767+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-27T03:32:34.798+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-27T03:32:35.810+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-05-27T03:32:36.813+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 10 events 2026-05-27T03:32:37.837+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-05-27T03:32:38.854+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-05-27T03:32:40.858+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-27T03:32:41.876+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:32:42.892+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-05-27T03:32:43.903+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T03:32:44.938+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 50 events 2026-05-27T03:32:45.931+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 2 events 2026-05-27T03:32:46.965+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-27T03:32:47.966+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-05-27T03:32:48.991+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-27T03:32:49.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":206796,"time":{"ms":62}},"total":{"ticks":2466155,"time":{"ms":437},"value":2466155},"user":{"ticks":2259359,"time":{"ms":375}}},"handles":{"open":317},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":136380665}},"memstats":{"gc_next":8359312,"memory_alloc":5211664,"memory_total":374082501880,"rss":438272}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":662,"batches":25,"total":662},"read":{"bytes":150},"write":{"bytes":147905}},"pipeline":{"clients":3,"events":{"active":28,"published":673,"total":673},"queue":{"acked":662}}},"msg_file_cache":{"SecurityHits":673},"published_events":{"Security":662,"total":662}}}} 2026-05-27T03:32:50.004+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-05-27T03:32:51.030+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-05-27T03:32:53.035+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-27T03:32:54.058+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:32:55.076+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-05-27T03:32:56.093+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:32:57.122+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 51 events 2026-05-27T03:32:58.129+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-27T03:32:59.134+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-05-27T03:33:00.182+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 61 events 2026-05-27T03:33:01.174+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-27T03:33:03.178+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 5 events 2026-05-27T03:33:04.211+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-27T03:33:05.216+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T03:33:06.233+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-27T03:33:08.251+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-05-27T03:33:09.248+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 3 events 2026-05-27T03:33:10.286+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 50 events 2026-05-27T03:33:11.309+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 40 events 2026-05-27T03:33:13.337+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 54 events 2026-05-27T03:33:14.345+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T03:33:15.370+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:33:16.404+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 50 events 2026-05-27T03:33:18.401+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 7 events 2026-05-27T03:33:19.427+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-27T03:33:19.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":206812,"time":{"ms":16}},"total":{"ticks":2466483,"time":{"ms":328},"value":2466483},"user":{"ticks":2259671,"time":{"ms":312}}},"handles":{"open":317},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":136410665}},"memstats":{"gc_next":5779968,"memory_alloc":3981632,"memory_total":374148135104,"rss":28672}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":746,"batches":25,"total":746},"read":{"bytes":150},"write":{"bytes":157650}},"pipeline":{"clients":3,"events":{"active":37,"published":755,"total":755},"queue":{"acked":746}}},"msg_file_cache":{"SecurityHits":755},"published_events":{"Security":746,"total":746}}}} 2026-05-27T03:33:20.450+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-27T03:33:21.455+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-05-27T03:33:22.478+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-27T03:33:23.487+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T03:33:24.502+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T03:33:25.536+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 52 events 2026-05-27T03:33:26.543+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T03:33:27.545+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-05-27T03:33:28.601+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 67 events 2026-05-27T03:33:29.596+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 10 events 2026-05-27T03:33:31.621+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-27T03:33:32.645+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 43 events 2026-05-27T03:33:33.648+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-05-27T03:33:34.659+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-05-27T03:33:35.692+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 49 events 2026-05-27T03:33:36.704+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T03:33:38.729+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-05-27T03:33:39.736+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-05-27T03:33:40.756+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-27T03:33:41.788+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-05-27T03:33:42.799+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-27T03:33:43.817+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:33:44.856+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-27T03:33:45.866+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-05-27T03:33:46.870+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-05-27T03:33:48.902+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-05-27T03:33:49.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":206828,"time":{"ms":16}},"total":{"ticks":2466812,"time":{"ms":329},"value":2466812},"user":{"ticks":2259984,"time":{"ms":313}}},"handles":{"open":317},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":136440665}},"memstats":{"gc_next":5645344,"memory_alloc":4905648,"memory_total":374214820704,"rss":-421888}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":763,"batches":26,"total":763},"read":{"bytes":156},"write":{"bytes":161550}},"pipeline":{"clients":3,"events":{"active":20,"published":746,"total":746},"queue":{"acked":763}}},"msg_file_cache":{"SecurityHits":746},"published_events":{"Security":763,"total":763}}}} 2026-05-27T03:33:49.911+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-27T03:33:50.922+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T03:33:51.954+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 38 events 2026-05-27T03:33:52.956+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T03:33:53.976+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:33:54.982+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-05-27T03:33:57.018+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-27T03:33:58.038+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-05-27T03:33:59.061+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-05-27T03:34:00.065+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-05-27T03:34:01.108+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 59 events 2026-05-27T03:34:03.105+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-05-27T03:34:04.131+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:34:05.146+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-27T03:34:06.157+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T03:34:08.184+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-27T03:34:09.188+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-05-27T03:34:10.198+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T03:34:11.220+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-05-27T03:34:12.233+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T03:34:13.254+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T03:34:14.285+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 54 events 2026-05-27T03:34:15.291+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-05-27T03:34:16.309+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:34:17.338+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 47 events 2026-05-27T03:34:19.354+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-05-27T03:34:19.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":206843,"time":{"ms":15}},"total":{"ticks":2467077,"time":{"ms":265},"value":2467077},"user":{"ticks":2260234,"time":{"ms":250}}},"handles":{"open":317},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":136470665}},"memstats":{"gc_next":5720480,"memory_alloc":3999424,"memory_total":374283147712,"rss":-4096}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":773,"batches":26,"total":773},"read":{"bytes":156},"write":{"bytes":164049}},"pipeline":{"clients":3,"events":{"active":37,"published":790,"total":790},"queue":{"acked":773}}},"msg_file_cache":{"SecurityHits":790},"published_events":{"Security":773,"total":773}}}} 2026-05-27T03:34:20.378+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-27T03:34:21.418+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 48 events 2026-05-27T03:34:22.420+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-05-27T03:34:24.441+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-05-27T03:34:25.447+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T03:34:26.469+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:34:27.485+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-05-27T03:34:28.491+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-27T03:34:29.534+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 62 events 2026-05-27T03:34:31.541+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:34:32.550+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-05-27T03:34:33.588+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 53 events 2026-05-27T03:34:34.579+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 5 events 2026-05-27T03:34:35.595+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T03:34:36.617+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-27T03:34:37.637+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:34:39.667+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-05-27T03:34:40.676+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T03:34:41.686+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T03:34:42.720+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 49 events 2026-05-27T03:34:43.715+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 6 events 2026-05-27T03:34:44.725+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 10 events 2026-05-27T03:34:45.771+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 64 events 2026-05-27T03:34:46.768+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-05-27T03:34:47.782+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T03:34:48.808+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-27T03:34:49.687+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":206859,"time":{"ms":16}},"total":{"ticks":2467437,"time":{"ms":360},"value":2467437},"user":{"ticks":2260578,"time":{"ms":344}}},"handles":{"open":317},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":136500666}},"memstats":{"gc_next":8339504,"memory_alloc":5018072,"memory_total":374349792400,"rss":36864}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":760,"batches":26,"total":760},"read":{"bytes":156},"write":{"bytes":161531}},"pipeline":{"clients":3,"events":{"active":22,"published":745,"total":745},"queue":{"acked":760}}},"msg_file_cache":{"SecurityHits":745},"published_events":{"Security":760,"total":760}}}} 2026-05-27T03:34:49.815+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T03:34:51.821+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 10 events 2026-05-27T03:34:52.854+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 44 events 2026-05-27T03:34:53.860+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-05-27T03:34:54.884+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-27T03:34:55.883+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 7 events 2026-05-27T03:34:57.904+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T03:34:58.927+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-05-27T03:34:59.935+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T03:35:00.950+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T03:35:01.981+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 47 events 2026-05-27T03:35:02.992+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T03:35:04.996+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-05-27T03:35:06.017+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-27T03:35:07.028+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-05-27T03:35:08.065+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 55 events 2026-05-27T03:35:09.072+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-05-27T03:35:10.101+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-27T03:35:12.128+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-05-27T03:35:13.141+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:35:14.162+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-05-27T03:35:15.184+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-05-27T03:35:16.199+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T03:35:17.231+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 48 events 2026-05-27T03:35:18.241+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-27T03:35:19.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":206875,"time":{"ms":16}},"total":{"ticks":2467734,"time":{"ms":297},"value":2467734},"user":{"ticks":2260859,"time":{"ms":281}}},"handles":{"open":317},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":136530665}},"memstats":{"gc_next":5239456,"memory_alloc":3126552,"memory_total":374414724568,"rss":-458752}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":742,"batches":25,"total":742},"read":{"bytes":150},"write":{"bytes":160468}},"pipeline":{"clients":3,"events":{"active":22,"published":742,"total":742},"queue":{"acked":742}}},"msg_file_cache":{"SecurityHits":742},"published_events":{"Security":742,"total":742}}}} 2026-05-27T03:35:20.258+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T03:35:21.281+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T03:35:22.290+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-27T03:35:23.320+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-05-27T03:35:24.346+0800 I&@K{fik-ii3y{fG|Rx>zH`\gA"3!K6/Did4DI3g s;D~<8φplA"4H!d4F/H/W_=p~!I$wFN.GG64ȎWxg-cy:BGBd]}!4Lј<};YD:IWAq{WWKkfAAA9`niPJjFoy O1$/нMW} 7a NBփt}f\lX~rʙT9f"q{.Aњә(C}=Ϡoj̀0gGGkD^m 1<[u}OQ'@rT0ȳyHd;reqͥH"$&Ir